CVE-2024-53007CWE-648

Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call

Medium · published January 31, 2025

CVSS v3.1
6.4
EPSS
0%
Percentile
2.1
In the wild
Unconfirmed
What it is

Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N/E:P/RL:T/RC:C
CVSS v4.0
Not supplied
EPSS
0.00126 · 2.1th percentile
Weakness
CWE-648 · Incorrect Use of Privileged APIs
Published
2025-01-31T00:00Z
EPSS history
Timeline
  • 31 JAN 00:00Z
    Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call
    cvelistv5